CVE-2026-109183: jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated jshERP user can exploit it. The vulnerability requires low-level privileges but does not require user interaction.
What does an attacker need to send?
The attacker needs to submit a POST request to /depotHead/addDepotHeadAndDetail with the status parameter set to 1. This causes the request to bypass audit permission checks and multi-level approval workflows.
What is the operational impact of successful exploitation?
An attacker can create bills that are already marked as audited. Those bills can affect stock records and report queries, resulting in unauthorized integrity changes.
How can defenders look for possible exploitation?
Review requests and created depot-head bills for use of status=1 through /depotHead/addDepotHeadAndDetail, particularly where the creating user did not have the expected audit permission or where approval workflow records are absent.